<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  
  <title>linux docker安装elk | 清峰小栈</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  
  <meta name="keywords" content="elk" />
  
  
  
  
  <meta name="description" content="Linux docker安装ELK实现目标： 从kafka收集消息 –&gt; Logstash清洗消息 –&gt; Elastcsearch存储消息–&gt; Kibana展示消息全流程 一、安装ElasticSearchELK简介ELK主要由ElasticSearch、Logstash和Kibana三个开源工具组成，还有其他专门由于收集数据的轻量型数据采集器Beats  Elasticsear">
<meta property="og:type" content="article">
<meta property="og:title" content="Linux docker安装ELK">
<meta property="og:url" content="http://example.com/2023/02/28/%E8%BF%90%E7%BB%B4%E5%AE%89%E8%A3%85/Linux%20docker%E5%AE%89%E8%A3%85ELK/index.html">
<meta property="og:site_name" content="清峰小栈">
<meta property="og:description" content="Linux docker安装ELK实现目标： 从kafka收集消息 –&gt; Logstash清洗消息 –&gt; Elastcsearch存储消息–&gt; Kibana展示消息全流程 一、安装ElasticSearchELK简介ELK主要由ElasticSearch、Logstash和Kibana三个开源工具组成，还有其他专门由于收集数据的轻量型数据采集器Beats  Elasticsear">
<meta property="og:locale" content="en_US">
<meta property="article:published_time" content="2023-02-28T12:28:07.690Z">
<meta property="article:modified_time" content="2023-05-25T05:59:16.084Z">
<meta property="article:author" content="清峰">
<meta property="article:tag" content="elk">
<meta name="twitter:card" content="summary">
  

  

  <link rel="icon" href="/qingfeng-blog/css/images/mylogo-2.png">
  <link rel="apple-touch-icon" href="/qingfeng-blog/css/images/mylogo-2.png">
  
    <link href="//fonts.googleapis.com/css?family=Source+Code+Pro" rel="stylesheet" type="text/css">
  
  <link href="https://fonts.googleapis.com/css?family=Open+Sans|Montserrat:700" rel="stylesheet" type="text/css">
  <link href="https://fonts.googleapis.com/css?family=Roboto:400,300,300italic,400italic" rel="stylesheet" type="text/css">
  <!-- <link href="//netdna.bootstrapcdn.com/font-awesome/4.0.3/css/font-awesome.css" rel="stylesheet"> -->
  <link href="/qingfeng-blog/css/font-awesome.css" rel="stylesheet">
  <style type="text/css">
    @font-face{font-family:futura-pt; src:url("/qingfeng-blog/css/fonts/FuturaPTBold.otf") format("woff");font-weight:500;font-style:normal;}
    @font-face{font-family:futura-pt-light; src:url("/qingfeng-blog/css/fonts/FuturaPTBook.otf") format("woff");font-weight:lighter;font-style:normal;}
    @font-face{font-family:futura-pt-italic; src:url("/qingfeng-blog/css/fonts/FuturaPTBookOblique.otf") format("woff");font-weight:400;font-style:italic;}
}

  </style>
  
<link rel="stylesheet" href="/qingfeng-blog/css/style.css">


  
<script src="/qingfeng-blog/js/jquery-3.1.1.min.js"></script>

  
<script src="/qingfeng-blog/js/bootstrap.js"></script>


  <!-- Bootstrap core CSS -->
  <link rel="stylesheet" href="/qingfeng-blog/css/bootstrap.css" >

  
    
<link rel="stylesheet" href="/qingfeng-blog/css/dialog.css">

  

  

  
    <link rel="stylesheet" href="/qingfeng-blog/css/header-post.css" >
  

  
  
  
    <link rel="stylesheet" href="/qingfeng-blog/css/vdonate.css" >
  

<meta name="generator" content="Hexo 6.3.0"></head>



  <body data-spy="scroll" data-target="#toc" data-offset="50">


  
  <div id="container">
    <div id="wrap">
      
        <header>

    <div id="allheader" class="navbar navbar-default navbar-static-top" role="navigation">
        <div class="navbar-inner">
          
          <div class="container"> 
            <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
              <span class="sr-only">Toggle navigation</span>
              <span class="icon-bar"></span>
              <span class="icon-bar"></span>
              <span class="icon-bar"></span>
            </button>

            
              <a class="brand" style="
                 border-width: 0px;  margin-top: 0px;"  
                href="#" data-toggle="modal" data-target="#myModal" >
                  <img width="155px" height="90px" alt="Hike News" src="/qingfeng-blog/css/images/mylogo-2.png">
              </a>
            
            
            <div class="navbar-collapse collapse">
              <ul class="hnav navbar-nav">
                
                  <li> <a class="main-nav-link" href="/qingfeng-blog/">首页</a> </li>
                
                  <li> <a class="main-nav-link" href="/qingfeng-blog/categories">分类</a> </li>
                
                  <li> <a class="main-nav-link" href="/qingfeng-blog/tags">标签</a> </li>
                
                  <li><div id="search-form-wrap">

    <form class="search-form">
        <input type="text" class="ins-search-input search-form-input" placeholder="" />
        <button type="submit" class="search-form-submit"></button>
    </form>
    <div class="ins-search">
    <div class="ins-search-mask"></div>
    <div class="ins-search-container">
        <div class="ins-input-wrapper">
            <input type="text" class="ins-search-input" placeholder="Type something..." />
            <span class="ins-close ins-selectable"><i class="fa fa-times-circle"></i></span>
        </div>
        <div class="ins-section-wrapper">
            <div class="ins-section-container"></div>
        </div>
    </div>
</div>
<script>
(function (window) {
    var INSIGHT_CONFIG = {
        TRANSLATION: {
            POSTS: 'Posts',
            PAGES: 'Pages',
            CATEGORIES: 'Categories',
            TAGS: 'Tags',
            UNTITLED: '(Untitled)',
        },
        ROOT_URL: '/qingfeng-blog/',
        CONTENT_URL: '/qingfeng-blog/content.json',
    };
    window.INSIGHT_CONFIG = INSIGHT_CONFIG;
})(window);
</script>

<script src="/qingfeng-blog/js/insight.js"></script>


</div></li>
            </div>
          </div>
                
      </div>
    </div>

</header>



      
            
      <div id="content" class="outer">
        
          <section id="main" style="float:none;"><article id="post-运维安装/Linux docker安装ELK" style="width: 75%; float:left;" class="article article-type-post" itemscope itemprop="blogPost" >
<div id="container">
  <div id="articleInner" class="article-inner">
    
    
      <header class="article-header">
        
  
    <h1 class="thumb" class="article-title" itemprop="name">
      Linux docker安装ELK
    </h1>
  

      </header>
    
    <div class="article-meta">
      
	<a href="/qingfeng-blog/2023/02/28/%E8%BF%90%E7%BB%B4%E5%AE%89%E8%A3%85/Linux%20docker%E5%AE%89%E8%A3%85ELK/" class="article-date">
	  <time datetime="2023-02-28T12:28:07.690Z" itemprop="datePublished">2023-02-28</time>
	</a>

      
    <a class="article-category-link" href="/qingfeng-blog/categories/Docker/">Docker</a>

      
	<a class="article-views">
	<span id="busuanzi_container_page_pv">
		PV:<span id="busuanzi_value_page_pv"></span>
	</span>
	</a>

      

    </div>
    <div class="article-entry" itemprop="articleBody">
      
        <h1 id="Linux-docker安装ELK"><a href="#Linux-docker安装ELK" class="headerlink" title="Linux docker安装ELK"></a>Linux docker安装ELK</h1><p><strong>实现目标：</strong></p>
<p><strong>从kafka收集消息 –&gt; Logstash清洗消息 –&gt; Elastcsearch存储消息–&gt; Kibana展示消息全流程</strong></p>
<h2 id="一、安装ElasticSearch"><a href="#一、安装ElasticSearch" class="headerlink" title="一、安装ElasticSearch"></a>一、安装ElasticSearch</h2><h3 id="ELK简介"><a href="#ELK简介" class="headerlink" title="ELK简介"></a><strong>ELK简介</strong></h3><p>ELK主要由ElasticSearch、Logstash和Kibana三个开源工具组成，还有其他专门由于收集数据的轻量型数据采集器Beats</p>
<blockquote>
<p>Elasticsearch：分布式搜索引擎。具有高可伸缩、高可靠、易管理等特点。可以用于全文检索、结构化检索和分析，并能将这三者结合起来<br>Elasticsearch：<br>是用Java 基于 Lucene 开发，现在使用最广的开源搜索引擎之一，Wikipedia 、StackOverflow、Github等都基于它来构建自己的搜索引擎。在elasticsearch中，所有节点的数据是均等的。</p>
<p>Logstash ：<br>数据收集处理引擎。支持动态的从各种数据源搜集数据，并对数据进行过滤、分析、丰富、统一格式等操作，然后存储以供后续使用。</p>
<p>Kibana ：<br>可视化化平台。它能够搜索、展示存储在 Elasticsearch<br>中索引数据。使用它可以很方便的用图表、表格、地图展示和分析数据。</p>
<p>版本说明：<br>Elasticsearch、Logstash、Kibana、Filebeat安装的版本号必须全部一致,不然会出现kibana无法显示web页面。</p>
</blockquote>
<blockquote>
<p>需要注意的是，如果操作系统版本不是很新不要安装最新版本docker，比如我centos7.2安装docker最新版，后面出现 linux 与 docker 版本的兼容性问题，报错”container init exited prematurely“，卸载docker安装较早版本即可。</p>
</blockquote>
<p>离线安装与在线基本相同（离线需要自行打包好镜像）</p>
<blockquote>
<p>离线思路：<br>1、在有网环境下下载镜像<br>2、通过docker save 打包好镜像，拷入u盘<br>3、将打包好的镜像上传至离线服务器<br>4、通过docker load 将打包好的镜像导入docker</p>
</blockquote>
<h3 id="1、拉取镜像"><a href="#1、拉取镜像" class="headerlink" title="1、拉取镜像"></a>1、拉取镜像</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">docker search elasticsearch</span><br><span class="line">docker pull elasticsearch:7.7.1</span><br></pre></td></tr></table></figure>

<h3 id="2、创建挂载目录"><a href="#2、创建挂载目录" class="headerlink" title="2、创建挂载目录"></a>2、创建挂载目录</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">mkdir -p /data/elk/es/&#123;config,data,logs&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3、赋予权限"><a href="#3、赋予权限" class="headerlink" title="3、赋予权限"></a>3、赋予权限</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">chmod -R 777 /data/elk/es</span><br><span class="line">chmod -R 777 /data/elk/es/config</span><br><span class="line">chmod -R 777 /data/elk/es/data</span><br><span class="line">chmod -R 777 /data/elk/es/logs</span><br><span class="line">#报错挂载目录没权限</span><br><span class="line">&quot;Caused by: java.nio.file.AccessDeniedException: /usr/share/elasticsearch/data/nodes&quot;,</span><br></pre></td></tr></table></figure>

<h3 id="4、创建挂载es配置"><a href="#4、创建挂载es配置" class="headerlink" title="4、创建挂载es配置"></a>4、创建挂载es配置</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">cd /data/elk/es/config</span><br><span class="line">touch elasticsearch.yml</span><br><span class="line">-----------------------配置内容----------------------------------</span><br><span class="line">cluster.name: &quot;my-es&quot;</span><br><span class="line">network.host: 0.0.0.0</span><br><span class="line">http.port: 9200</span><br></pre></td></tr></table></figure>

<h3 id="5、运行elasticsearch"><a href="#5、运行elasticsearch" class="headerlink" title="5、运行elasticsearch"></a>5、运行elasticsearch</h3><blockquote>
<p>通过镜像，启动一个容器，并将9200和9300端口映射到本机（elasticsearch的默认端口是9200，我们把宿主环境9200端口映射到Docker容器中的9200端口）。此处建议给容器设置固定ip，我这里没设置。</p>
</blockquote>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker run -it  -d -p 9200:9200 -p 9300:9300 --name es -e ES_JAVA_OPTS=&quot;-Xms1g -Xmx1g&quot; -e &quot;discovery.type=single-node&quot; --restart=always -v /data/elk/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml -v /data/elk/es/data:/usr/share/elasticsearch/data -v /data/elk/es/logs:/usr/share/elasticsearch/logs elasticsearch:7.7.1</span><br></pre></td></tr></table></figure>

<h3 id="6、验证安装是否成功"><a href="#6、验证安装是否成功" class="headerlink" title="6、验证安装是否成功"></a>6、验证安装是否成功</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">[root@elasticsearch home]# curl http://localhost:9200</span><br><span class="line">&#123;</span><br><span class="line">  &quot;name&quot; : &quot;0adf1765ac08&quot;,</span><br><span class="line">  &quot;cluster_name&quot; : &quot;my-es&quot;,</span><br><span class="line">  &quot;cluster_uuid&quot; : &quot;MpKqrEKySnSdwux0m7AlEA&quot;,</span><br><span class="line">  &quot;version&quot; : &#123;</span><br><span class="line">    &quot;number&quot; : &quot;7.7.1&quot;,</span><br><span class="line">    &quot;build_flavor&quot; : &quot;default&quot;,</span><br><span class="line">    &quot;build_type&quot; : &quot;docker&quot;,</span><br><span class="line">    &quot;build_hash&quot; : &quot;ad56dce891c901a492bb1ee393f12dfff473a423&quot;,</span><br><span class="line">    &quot;build_date&quot; : &quot;2020-05-28T16:30:01.040088Z&quot;,</span><br><span class="line">    &quot;build_snapshot&quot; : false,</span><br><span class="line">    &quot;lucene_version&quot; : &quot;8.5.1&quot;,</span><br><span class="line">    &quot;minimum_wire_compatibility_version&quot; : &quot;6.8.0&quot;,</span><br><span class="line">    &quot;minimum_index_compatibility_version&quot; : &quot;6.0.0-beta1&quot;</span><br><span class="line">  &#125;,</span><br><span class="line">  &quot;tagline&quot; : &quot;You Know, for Search&quot;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">查看索引</span><br><span class="line">GET /_cat/indices?v</span><br></pre></td></tr></table></figure>

<p><a target="_blank" rel="noopener" href="https://so.csdn.net/so/search?q=elasticsearch&spm=1001.2101.3001.7020">elasticsearch</a>启动时遇到的错误</p>
<p>es最大虚拟内存至少262144</p>
<p>max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">1、vim /etc/sysctl.conf (需要是root账户)</span><br><span class="line">文件最后添加一行: vm.max_map_count=262144</span><br><span class="line">2、sysctl -p 重启生效</span><br></pre></td></tr></table></figure>

<h2 id="二、安装Kibana"><a href="#二、安装Kibana" class="headerlink" title="二、安装Kibana"></a>二、<strong>安装Kibana</strong></h2><h3 id="1、下载镜像"><a href="#1、下载镜像" class="headerlink" title="1、下载镜像"></a>1、下载镜像</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker pull kibana:7.7.1</span><br></pre></td></tr></table></figure>

<h3 id="2、获取elasticsearch容器ip"><a href="#2、获取elasticsearch容器ip" class="headerlink" title="2、获取elasticsearch容器ip"></a>2、获取elasticsearch容器ip</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">[root@elasticsearch home]# docker inspect --format &#x27;&#123;&#123; .NetworkSettings.IPAddress &#125;&#125;&#x27; es</span><br><span class="line">172.17.0.2</span><br></pre></td></tr></table></figure>

<h3 id="3、新建配置文件"><a href="#3、新建配置文件" class="headerlink" title="3、新建配置文件"></a>3、新建配置文件</h3><p>用于docker文件映射。所使用目录需对应新增。（172.17.0.2改成自己的）</p>
<p>vi &#x2F;data&#x2F;elk&#x2F;kibana&#x2F;kibana.yml</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">#Default Kibana configuration for docker target</span><br><span class="line">server.name: kibana</span><br><span class="line">server.host: &quot;0&quot;</span><br><span class="line">i18n.locale: &quot;zh-CN&quot;</span><br><span class="line">elasticsearch.hosts: [&quot;http://172.17.0.2:9200&quot;]</span><br><span class="line">xpack.monitoring.ui.container.elasticsearch.enabled: true</span><br></pre></td></tr></table></figure>

<h3 id="4、运行kibana"><a href="#4、运行kibana" class="headerlink" title="4、运行kibana"></a>4、运行kibana</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 --name kibana -p 5601:5601 -v /data/elk/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml kibana:7.7.1</span><br></pre></td></tr></table></figure>







<h3 id="5、访问"><a href="#5、访问" class="headerlink" title="5、访问"></a>5、访问</h3><p>浏览器上输入：<a href="http://ip:5601，如无法访问进容器检查配置是否生效">http://ip:5601，如无法访问进容器检查配置是否生效</a></p>
<h3 id="6、检查kibana容器配置文件"><a href="#6、检查kibana容器配置文件" class="headerlink" title="6、检查kibana容器配置文件"></a>6、检查kibana容器配置文件</h3><p>将配置文件中elasticsearch.hosts地址修改为elasticsearch容器地址。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker exec -it kibana /bin/bash</span><br></pre></td></tr></table></figure>

<p>vi config&#x2F;kibana.yml，修改后的配置如下：<br>（（172.17.0.2改成自己的））</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">#Default Kibana configuration for docker target</span><br><span class="line">server.name: kibana</span><br><span class="line">server.host: &quot;0&quot;</span><br><span class="line">elasticsearch.hosts: [&quot;http://172.17.0.2:9200&quot;]</span><br><span class="line">xpack.monitoring.ui.container.elasticsearch.enabled: true</span><br></pre></td></tr></table></figure>

<p>重启kibana：docker restart kibana</p>
<blockquote>
<p>在kibana6.7之后就开始支持中文了，开启也很简单，只需要在kibana.yml配置文件中添加上如下配置，然后重启kibana即可</p>
<p>i18n.locale: “zh-CN”</p>
</blockquote>
<h2 id="三、安装Logstash"><a href="#三、安装Logstash" class="headerlink" title="三、安装Logstash"></a>三、安装<strong>Logstash</strong></h2><h3 id="1、获取logstash镜像"><a href="#1、获取logstash镜像" class="headerlink" title="1、获取logstash镜像"></a>1、获取logstash镜像</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker pull logstash:7.7.1</span><br></pre></td></tr></table></figure>

<h3 id="2、编辑logstash-yml配置文件"><a href="#2、编辑logstash-yml配置文件" class="headerlink" title="2、编辑logstash.yml配置文件"></a>2、编辑logstash.yml配置文件</h3><p>vi &#x2F;data&#x2F;elk&#x2F;logstash&#x2F;logstash.yml （es-docker内网地址）<br>（172.17.0.2改成自己的）</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">http.host: &quot;0.0.0.0&quot;</span><br><span class="line">xpack.monitoring.elasticsearch.hosts: [ &quot;http://172.17.0.2:9200&quot; ]</span><br><span class="line">xpack.monitoring.elasticsearch.username: elastic</span><br><span class="line">xpack.monitoring.elasticsearch.password: changeme</span><br><span class="line">#path.config: /data/elk/logstash/conf.d/*.conf</span><br><span class="line">path.config: /data/docker/logstash/conf.d/*.conf</span><br><span class="line">path.logs: /var/log/logstash</span><br></pre></td></tr></table></figure>

<h3 id="3、编辑logstash-conf文件"><a href="#3、编辑logstash-conf文件" class="headerlink" title="3、编辑logstash.conf文件"></a>3、编辑logstash.conf文件</h3><p>此处先配置logstash直接采集本地数据发送至es</p>
<p>vi &#x2F;data&#x2F;elk&#x2F;logstash&#x2F;conf.d&#x2F;syslog.conf   （外网地址）<br>（192.168.200.94改成自己的）</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">input &#123;</span><br><span class="line">  syslog &#123;</span><br><span class="line">    type =&gt; &quot;system-syslog&quot;</span><br><span class="line">    port =&gt; 5044</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line">output &#123;</span><br><span class="line">  elasticsearch &#123;</span><br><span class="line">    hosts =&gt; [&quot;192.168.x.x:9200&quot;]  # 定义es服务器的ip</span><br><span class="line">    index =&gt; &quot;system-syslog-%&#123;+YYYY.MM&#125;&quot; # 定义索引</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h3 id="4、配置修改后重启服务"><a href="#4、配置修改后重启服务" class="headerlink" title="4、配置修改后重启服务"></a>4、配置修改后重启服务</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">systemctl restart rsyslog</span><br></pre></td></tr></table></figure>

<h3 id="5、运行logstash"><a href="#5、运行logstash" class="headerlink" title="5、运行logstash"></a>5、运行logstash</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 -p 9600:9600 --name logstash -v /data/elk/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/data/docker/logstash/conf.d/ logstash:7.7.1</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">docker run -d --privileged=true -p 5044:5044 -p 9600:9600 --name logstash -v /data/elk/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/data/docker/logstash/conf.d/ docker.elastic.co/logstash/logstash:7.13.0-arm64</span><br></pre></td></tr></table></figure>

<h3 id="6、测试es接收logstash数据"><a href="#6、测试es接收logstash数据" class="headerlink" title="6、测试es接收logstash数据"></a>6、测试es接收logstash数据</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[root@elk logstash]# curl http://localhost:9200/_cat/indices?v</span><br><span class="line">health status index                    uuid                   pri rep docs.count docs.deleted store.size pri.store.size</span><br><span class="line">green  open   .apm-custom-link         WBgbpphkQCS73sfjjIG0-Q   1   0          0            0       208b           208b</span><br><span class="line">green  open   .kibana_task_manager_1   xmBASGi9QheR-r8hG2XLZA   1   0          5            0       28kb           28kb</span><br><span class="line">green  open   .apm-agent-configuration MsvsgveHSCOhBQRCgTnsRg   1   0          0            0       208b           208b</span><br><span class="line">yellow open   system-syslog-2022.02    1Vcjw7Q-TTqVscpknyK7HA   1   1          6            0     20.7kb         20.7kb</span><br><span class="line">green  open   .kibana_1                vJ-B5wakRSmOrwM6ri-xgw   1   0         84            2      115kb          115kb</span><br></pre></td></tr></table></figure>

<p>获取到system-syslog-相关日志，则es已能获取来自logstash的数据，kibana中也同步显示数据。</p>
<h2 id="四、安装kafka"><a href="#四、安装kafka" class="headerlink" title="四、安装kafka"></a>四、安装kafka</h2><blockquote>
<p>注意：</p>
<p>出现&#x2F;docker-entrypoint.sh: line 43: &#x2F;conf&#x2F;zoo.cfg: Permission denied</p>
<p>一般都是目录没权限，给对应目录添加权限即可</p>
<p>chmod 777 xxx</p>
</blockquote>
<h3 id="1、启动zookeeper容器"><a href="#1、启动zookeeper容器" class="headerlink" title="1、启动zookeeper容器"></a>1、启动zookeeper容器</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">docker run -d --name zookeeper -p 2181:2181 -t wurstmeister/zookeeper</span><br><span class="line"></span><br><span class="line">docker run -d -p 2181:2181 -p 2888:2888 -p 3888:3888 --privileged=true \</span><br><span class="line">--restart=always --name=zkNode-1 \</span><br><span class="line">-v /data/elk/zookeeper/conf:/conf \</span><br><span class="line">-v /data/elk/zookeeper/data:/data \</span><br><span class="line">-v /data/elk/zookeeper/datalog:/datalog zookeeper:latest</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h3 id="2、启动kafka容器"><a href="#2、启动kafka容器" class="headerlink" title="2、启动kafka容器"></a>2、启动kafka容器</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">#修改自己的zookeeper主机地址</span><br><span class="line">docker run  -d --name kafka -p 9092:9092 -e KAFKA_BROKER_ID=0 -e KAFKA_ZOOKEEPER_CONNECT=192.168.x.x:2181 -e KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://192.168.x.x:9092 -e KAFKA_LISTENERS=PLAINTEXT://0.0.0.0:9092 -e ALLOW_PLAINTEXT_LISTENER=yes -t wurstmeister/kafka </span><br><span class="line"></span><br><span class="line">#docker 启动参数说明: -d:后台启动,--restart=always:如果挂了总是会重启,--name:设置容器名</span><br><span class="line">#-p: 设置宿主机与容器之间的端口映射,例如:9902:9092,表示将容器中9092端口映射到宿主机的9902端口,当有请求访问宿主机的9902端口时,会被转发到容器内部的9092端口.</span><br><span class="line">#-v:设置宿主机与容器之间的路径或文件映射,例如:/home/kafka/logs:/opt/kafka/logs,表示将容器内部的路径/opt/kafka/logs目录映射到宿主机的/home/kafka/logs目录,可以方便的从宿主机/home/kafka/logs/就能访问到容器内的目录,一般数据文件夹,配置文件均可如此配置,便于管理和数据持久化</span><br><span class="line">#-e 设置环境变量参数,例如-e KAFKA_BROKER_ID=1,表示将该环境变量设置到容器的环境变量中,容器在启动时会读取该环境变量,并替换掉容器中配置文件的对应默认配置(server.properties文件中的 broker.id=1)</span><br><span class="line"># kafka:latest 表示使用docker镜像名称为kafka,并且版本为latest的镜像来启动</span><br><span class="line">docker run -d --restart=always --name kafka \</span><br><span class="line">-p 9092:9092 \</span><br><span class="line">-v /data/elk/kafka/logs:/opt/kafka/logs \</span><br><span class="line">-v /data/elk/kafka/data:/kafka/kafka-logs \</span><br><span class="line">-v /data/elk/kafka/conf:/opt/kafka/config \</span><br><span class="line">-e KAFKA_BROKER_ID=1 \</span><br><span class="line">-e KAFKA_LOG_DIRS=&quot;/kafka/kafka-logs&quot; \</span><br><span class="line">-e KAFKA_ZOOKEEPER_CONNECT=10.84.x.x:2181 \</span><br><span class="line">-e KAFKA_DEFAULT_REPLICATION_FACTOR=1 \</span><br><span class="line">-e KAFKA_LOG_RETENTION_HOURS=72 \</span><br><span class="line">-e KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://10.84.x.x:9092 \</span><br><span class="line">-e ALLOW_PLAINTEXT_LISTENER=yes \</span><br><span class="line">-e KAFKA_LISTENERS=PLAINTEXT://0.0.0.0:9092 -t kafka:latest</span><br></pre></td></tr></table></figure>

<h3 id="3、测试kafka"><a href="#3、测试kafka" class="headerlink" title="3、测试kafka"></a>3、测试kafka</h3><p>进入kafka容器的命令行</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker exec -ti kafka /bin/bash</span><br></pre></td></tr></table></figure>

<p>进入kafka所在目录</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">cd opt/kafka_2.13-2.8.1/</span><br><span class="line">#没有找到就用这个命令搜索</span><br><span class="line">find / -name kafka-topics.sh</span><br></pre></td></tr></table></figure>

<h3 id="4、创建topic"><a href="#4、创建topic" class="headerlink" title="4、创建topic"></a>4、创建topic</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">./bin/kafka-topics.sh --create --bootstrap-server 10.84.x.x:2181 --partitions 1 --replication-factor 1 --topic cloud-log</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">./bin/kafka-topics.sh --create --bootstrap-server 127.0.0.1:9092 --partitions 1 --replication-factor 1 --topic cloud-log</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h3 id="5、查看topic-list"><a href="#5、查看topic-list" class="headerlink" title="5、查看topic list"></a>5、查看topic list</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">bin/kafka-topics.sh --zookeeper 10.84.x.x:2181 --list</span><br><span class="line"></span><br><span class="line">./bin/kafka-topics.sh --bootstrap-server 127.0.0.1:9092 --list</span><br></pre></td></tr></table></figure>

<h3 id="6、发送消息"><a href="#6、发送消息" class="headerlink" title="6、发送消息"></a>6、发送消息</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">./bin/kafka-console-producer.sh --broker-list 10.84.x.x:9092 --topic cloud-log</span><br><span class="line"></span><br><span class="line">./kafka-console-producer.sh --broker-list 10.32.22.51:9092 --topic cloud-log</span><br></pre></td></tr></table></figure>

<h3 id="7、接收消息"><a href="#7、接收消息" class="headerlink" title="7、接收消息"></a>7、接收消息</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">./bin/kafka-console-consumer.sh --bootstrap-server 10.84.x.x:9092 --topic cloud-log --from-beginning</span><br><span class="line"></span><br><span class="line">./bin/kafka-console-consumer.sh --bootstrap-server 10.32.22.51:9092 --topic cloud-log --from-beginning</span><br></pre></td></tr></table></figure>

<p>由于上面并未和kafka产生关联，所以修改logstash安装目录下的配置文件logstash&#x2F;confg&#x2F;conf.d&#x2F;syslog.conf</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line">input &#123;</span><br><span class="line">  #获取kafka信息</span><br><span class="line">  kafka &#123;</span><br><span class="line">  		#自定义话题</span><br><span class="line">        topics_pattern  =&gt; &quot;cloud-log&quot;</span><br><span class="line">        #kafka ip+端口</span><br><span class="line">        bootstrap_servers =&gt; &quot;10.84.x.x:9092&quot;</span><br><span class="line">        auto_offset_reset =&gt; &quot;earliest&quot;</span><br><span class="line">        consumer_threads =&gt; 5</span><br><span class="line">        decorate_events =&gt; &quot;true&quot;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line">#文本格式过滤</span><br><span class="line">filter &#123;</span><br><span class="line">    date &#123;</span><br><span class="line">      timezone =&gt; &quot;Asia/Shanghai&quot;</span><br><span class="line">      match =&gt; [&quot;logtime&quot;, &quot;yyyy-MM-dd HH:mm:ss,SSS&quot;]</span><br><span class="line">      target =&gt; &quot;@timestamp&quot;</span><br><span class="line">      remove_field =&gt; [ &quot;logtime&quot; ]</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">output &#123;</span><br><span class="line">  #输出至es</span><br><span class="line">  elasticsearch &#123;</span><br><span class="line">    hosts =&gt; [&quot;http://10.84.x.x:9200&quot;]</span><br><span class="line">    index =&gt; &quot;%&#123;[@metadata][kafka][topic]&#125;-%&#123;+YYYY-MM-dd&#125;&quot;</span><br><span class="line">  &#125;</span><br><span class="line">  #本地生产文件日志(目录自行创建)</span><br><span class="line">  file &#123;</span><br><span class="line">        path =&gt; &quot;/home/logs/%&#123;+yyyy-MM-dd-HH&#125;.log&quot;</span><br><span class="line">   &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p><strong>修改完之后重新启动docker-elk，即完成从kafka收集消息 –&gt; Logstash清洗消息 –&gt; Elastcsearch存储消息–&gt; Kibana展示消息全流程。</strong></p>
<p>在arm运行时上述kafka方式运行正常但无法连接至es</p>
<p>以下采用docker-compose的方式部署</p>
<figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">version:</span> <span class="string">&#x27;3.2&#x27;</span></span><br><span class="line"><span class="attr">services:</span></span><br><span class="line">  <span class="attr">zookeeper:</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">zookeeper</span></span><br><span class="line">    <span class="attr">ports:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">&quot;2181:2181&quot;</span></span><br><span class="line">    <span class="attr">privileged:</span> <span class="literal">true</span></span><br><span class="line">    <span class="attr">volumes:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/data/elk/zookeeper/conf:/conf</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/data/elk/zookeeper/data:/data</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/data/elk/zookeeper/datalog:/datalog</span> </span><br><span class="line">      <span class="bullet">-</span> <span class="string">/etc/localtime:/etc/localtime</span></span><br><span class="line">    <span class="attr">container_name:</span> <span class="string">&quot;zookeeper&quot;</span></span><br><span class="line">    <span class="attr">restart:</span> <span class="string">always</span></span><br><span class="line">  <span class="attr">kafka:</span></span><br><span class="line">    <span class="attr">image:</span> <span class="string">wyh1791/kafka-arm64v8</span></span><br><span class="line">    <span class="attr">container_name:</span> <span class="string">&quot;kafka&quot;</span></span><br><span class="line">    <span class="attr">ports:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">&quot;9092:9092&quot;</span></span><br><span class="line">    <span class="attr">privileged:</span> <span class="literal">true</span></span><br><span class="line">    <span class="attr">environment:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">TZ=Asia/Shanghai</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_AUTO_CREATE_TOPICS_ENABLE=true</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_ADVERTISED_HOST_NAME=10.32.22.52</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_ADVERTISED_PORT=9092</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://10.32.22.52:9092</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_LISTENERS=PLAINTEXT://0.0.0.0:9092</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">KAFKA_LOG_RETENTION_HOURS=168</span></span><br><span class="line">    <span class="attr">volumes:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/data/elk/kafka/data:/kafka</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/var/run/docker.sock:/var/run/docker.sock</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">/etc/localtime:/etc/localtime</span></span><br><span class="line">    <span class="attr">restart:</span> <span class="string">always</span></span><br><span class="line"></span><br></pre></td></tr></table></figure>


      
    </div>
    <footer class="article-footer">
      
        <div id="donation_div"></div>


<script src="/qingfeng-blog/js/vdonate.js"></script>

<script>
var a = new Donate({
  title: '如果觉得我的文章对您有用，请随意打赏。您的支持将鼓励我继续创作!', // 可选参数，打赏标题
  btnText: 'Donate', // 可选参数，打赏按钮文字
  el: document.getElementById('donation_div'),
  wechatImage: 'http://img.lindaifeng.vip/typora-picgo-tuchaung/20230428150832.png',
  alipayImage: 'http://img.lindaifeng.vip/typora-picgo-tuchaung/20230428150823.png'
});
</script>
      
      
      <div>
        <ul class="post-copyright">
          <li class="post-copyright-author">
          <strong>Post author:  </strong>清峰</a>
          </li>
          <li class="post-copyright-link">
          <strong>Post link:  </strong>
          <a href="/qingfeng-blog/2023/02/28/运维安装/Linux docker安装ELK/" target="_blank" title="Linux docker安装ELK">http://example.com/2023/02/28/运维安装/Linux docker安装ELK/</a>
          </li>
          <li class="post-copyright-license">
            <strong>Copyright Notice:   </strong>
            All articles in this blog are licensed under <a rel="license" href="https://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank" title="Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)">CC BY-NC-ND 4.0</a>
            unless stating additionally.
          </li>
         
        </ul>
<div>

      
      
        
	<div id="comment">
		<!-- 来必力City版安装代码 -->
		<div id="lv-container" data-id="city" data-uid="MTAyMC8yOTQ4MS82MDQ5">
		<script type="text/javascript">
		   (function(d, s) {
		       var j, e = d.getElementsByTagName(s)[0];

		       if (typeof LivereTower === 'function') { return; }

		       j = d.createElement(s);
		       j.src = 'https://cdn-city.livere.com/js/embed.dist.js';
		       j.async = true;

		       e.parentNode.insertBefore(j, e);
		   })(document, 'script');
		</script>
		<noscript>为正常使用来必力评论功能请激活JavaScript</noscript>
		</div>
		<!-- City版安装代码已完成 -->
	</div>



      
      
        
  <ul class="article-tag-list" itemprop="keywords"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/qingfeng-blog/tags/elk/" rel="tag">elk</a></li></ul>

      

    </footer>
  </div>
</div>
  
    
<nav id="article-nav">
  
    <a href="/qingfeng-blog/2023/04/19/%E8%BF%90%E7%BB%B4%E5%AE%89%E8%A3%85/Linux%20docker%E5%AE%89%E8%A3%85%E5%90%84%E8%BD%AF%E4%BB%B6(%E6%B1%87%E6%80%BB)/" id="article-nav-newer" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Newer</strong>
      <div class="article-nav-title">
        
          docker安装各软件（汇总）
        
      </div>
    </a>
  
  
    <a href="/qingfeng-blog/2023/02/08/Linux/CentOS%20%E5%8D%87%E7%BA%A7%E5%86%85%E6%A0%B8/" id="article-nav-older" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Older</strong>
      <div class="article-nav-title">CentOS 升级内核</div>
    </a>
  
</nav>

  
</article>

<!-- Table of Contents -->

  <aside id="toc-sidebar">
    <div id="toc" class="toc-article">
    <strong class="toc-title">Contents</strong>
    
        <ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#Linux-docker%E5%AE%89%E8%A3%85ELK"><span class="nav-number">1.</span> <span class="nav-text">Linux docker安装ELK</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#%E4%B8%80%E3%80%81%E5%AE%89%E8%A3%85ElasticSearch"><span class="nav-number">1.1.</span> <span class="nav-text">一、安装ElasticSearch</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#ELK%E7%AE%80%E4%BB%8B"><span class="nav-number">1.1.1.</span> <span class="nav-text">ELK简介</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#1%E3%80%81%E6%8B%89%E5%8F%96%E9%95%9C%E5%83%8F"><span class="nav-number">1.1.2.</span> <span class="nav-text">1、拉取镜像</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2%E3%80%81%E5%88%9B%E5%BB%BA%E6%8C%82%E8%BD%BD%E7%9B%AE%E5%BD%95"><span class="nav-number">1.1.3.</span> <span class="nav-text">2、创建挂载目录</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3%E3%80%81%E8%B5%8B%E4%BA%88%E6%9D%83%E9%99%90"><span class="nav-number">1.1.4.</span> <span class="nav-text">3、赋予权限</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4%E3%80%81%E5%88%9B%E5%BB%BA%E6%8C%82%E8%BD%BDes%E9%85%8D%E7%BD%AE"><span class="nav-number">1.1.5.</span> <span class="nav-text">4、创建挂载es配置</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5%E3%80%81%E8%BF%90%E8%A1%8Celasticsearch"><span class="nav-number">1.1.6.</span> <span class="nav-text">5、运行elasticsearch</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#6%E3%80%81%E9%AA%8C%E8%AF%81%E5%AE%89%E8%A3%85%E6%98%AF%E5%90%A6%E6%88%90%E5%8A%9F"><span class="nav-number">1.1.7.</span> <span class="nav-text">6、验证安装是否成功</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E4%BA%8C%E3%80%81%E5%AE%89%E8%A3%85Kibana"><span class="nav-number">1.2.</span> <span class="nav-text">二、安装Kibana</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1%E3%80%81%E4%B8%8B%E8%BD%BD%E9%95%9C%E5%83%8F"><span class="nav-number">1.2.1.</span> <span class="nav-text">1、下载镜像</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2%E3%80%81%E8%8E%B7%E5%8F%96elasticsearch%E5%AE%B9%E5%99%A8ip"><span class="nav-number">1.2.2.</span> <span class="nav-text">2、获取elasticsearch容器ip</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3%E3%80%81%E6%96%B0%E5%BB%BA%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6"><span class="nav-number">1.2.3.</span> <span class="nav-text">3、新建配置文件</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4%E3%80%81%E8%BF%90%E8%A1%8Ckibana"><span class="nav-number">1.2.4.</span> <span class="nav-text">4、运行kibana</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5%E3%80%81%E8%AE%BF%E9%97%AE"><span class="nav-number">1.2.5.</span> <span class="nav-text">5、访问</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#6%E3%80%81%E6%A3%80%E6%9F%A5kibana%E5%AE%B9%E5%99%A8%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6"><span class="nav-number">1.2.6.</span> <span class="nav-text">6、检查kibana容器配置文件</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E4%B8%89%E3%80%81%E5%AE%89%E8%A3%85Logstash"><span class="nav-number">1.3.</span> <span class="nav-text">三、安装Logstash</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1%E3%80%81%E8%8E%B7%E5%8F%96logstash%E9%95%9C%E5%83%8F"><span class="nav-number">1.3.1.</span> <span class="nav-text">1、获取logstash镜像</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2%E3%80%81%E7%BC%96%E8%BE%91logstash-yml%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6"><span class="nav-number">1.3.2.</span> <span class="nav-text">2、编辑logstash.yml配置文件</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3%E3%80%81%E7%BC%96%E8%BE%91logstash-conf%E6%96%87%E4%BB%B6"><span class="nav-number">1.3.3.</span> <span class="nav-text">3、编辑logstash.conf文件</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4%E3%80%81%E9%85%8D%E7%BD%AE%E4%BF%AE%E6%94%B9%E5%90%8E%E9%87%8D%E5%90%AF%E6%9C%8D%E5%8A%A1"><span class="nav-number">1.3.4.</span> <span class="nav-text">4、配置修改后重启服务</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5%E3%80%81%E8%BF%90%E8%A1%8Clogstash"><span class="nav-number">1.3.5.</span> <span class="nav-text">5、运行logstash</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#6%E3%80%81%E6%B5%8B%E8%AF%95es%E6%8E%A5%E6%94%B6logstash%E6%95%B0%E6%8D%AE"><span class="nav-number">1.3.6.</span> <span class="nav-text">6、测试es接收logstash数据</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%9B%9B%E3%80%81%E5%AE%89%E8%A3%85kafka"><span class="nav-number">1.4.</span> <span class="nav-text">四、安装kafka</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1%E3%80%81%E5%90%AF%E5%8A%A8zookeeper%E5%AE%B9%E5%99%A8"><span class="nav-number">1.4.1.</span> <span class="nav-text">1、启动zookeeper容器</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2%E3%80%81%E5%90%AF%E5%8A%A8kafka%E5%AE%B9%E5%99%A8"><span class="nav-number">1.4.2.</span> <span class="nav-text">2、启动kafka容器</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3%E3%80%81%E6%B5%8B%E8%AF%95kafka"><span class="nav-number">1.4.3.</span> <span class="nav-text">3、测试kafka</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4%E3%80%81%E5%88%9B%E5%BB%BAtopic"><span class="nav-number">1.4.4.</span> <span class="nav-text">4、创建topic</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5%E3%80%81%E6%9F%A5%E7%9C%8Btopic-list"><span class="nav-number">1.4.5.</span> <span class="nav-text">5、查看topic list</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#6%E3%80%81%E5%8F%91%E9%80%81%E6%B6%88%E6%81%AF"><span class="nav-number">1.4.6.</span> <span class="nav-text">6、发送消息</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#7%E3%80%81%E6%8E%A5%E6%94%B6%E6%B6%88%E6%81%AF"><span class="nav-number">1.4.7.</span> <span class="nav-text">7、接收消息</span></a></li></ol></li></ol></li></ol>
    
    </div>
  </aside>


</section>
        
      </div>
      
      <footer id="footer">
  

  <div class="container">
      	<div class="row">
	      <!-- <p> Powered by <a href="http://hexo.io/" target="_blank">Hexo</a> and <a href="https://github.com/iTimeTraveler/hexo-theme-hiker" target="_blank">Hexo-theme-hiker</a> </p> -->
	      <p>May there be no bug in the world！</p>
        <p id="copyRightEn">Copyright &copy; 2022 - 2023 All Rights Reserved.</p>
	      
	      
    		<p class="busuanzi_uv">
				UV : <span id="busuanzi_value_site_uv"></span> |  
				PV : <span id="busuanzi_value_site_pv"></span>
		    </p>
  		   
		</div>

		
  </div>
</footer>


<!-- min height -->

<script>
    var wrapdiv = document.getElementById("wrap");
    var contentdiv = document.getElementById("content");
    var allheader = document.getElementById("allheader");

    wrapdiv.style.minHeight = document.body.offsetHeight + "px";
    if (allheader != null) {
      contentdiv.style.minHeight = document.body.offsetHeight - allheader.offsetHeight - document.getElementById("footer").offsetHeight + "px";
    } else {
      contentdiv.style.minHeight = document.body.offsetHeight - document.getElementById("footer").offsetHeight + "px";
    }
</script>
    </div>
    <!-- <nav id="mobile-nav">
  
    <a href="/qingfeng-blog/" class="mobile-nav-link">首页</a>
  
    <a href="/qingfeng-blog/categories" class="mobile-nav-link">分类</a>
  
    <a href="/qingfeng-blog/tags" class="mobile-nav-link">标签</a>
  
</nav> -->
    

<!-- mathjax config similar to math.stackexchange -->

<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [ ['$','$'], ["\\(","\\)"] ],
      processEscapes: true
    }
  });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Config({
      tex2jax: {
        skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
      }
    });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for(i=0; i < all.length; i += 1) {
            all[i].SourceElement().parentNode.className += ' has-jax';
        }
    });
</script>

<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>


  
<link rel="stylesheet" href="/qingfeng-blog/fancybox/jquery.fancybox.css">

  
<script src="/qingfeng-blog/fancybox/jquery.fancybox.pack.js"></script>




<script src="/qingfeng-blog/js/scripts.js"></script>



  
<script src="/qingfeng-blog/js/home.js"></script>




  
<script src="/qingfeng-blog/js/dialog.js"></script>









	<div style="display: none;">
    <script src="https://s95.cnzz.com/z_stat.php?id=1260716016&web_id=1260716016" language="JavaScript"></script>
  </div>



	<script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js">
	</script>






  </div>

  <div class="modal fade" id="myModal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true" style="display: none;">
  <div class="modal-dialog">
    <div class="modal-content">
      <div class="modal-header">
        <h2 class="modal-title" id="myModalLabel">设置</h2>
      </div>
      <hr style="margin-top:0px; margin-bottom:0px; width:80%; border-top: 3px solid #000;">
      <hr style="margin-top:2px; margin-bottom:0px; width:80%; border-top: 1px solid #000;">


      <div class="modal-body">
          <div style="margin:6px;">
            <a data-toggle="collapse" data-parent="#accordion" href="#collapseOne" onclick="javascript:setFontSize();" aria-expanded="true" aria-controls="collapseOne">
              正文字号大小
            </a>
          </div>
          <div id="collapseOne" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingOne">
          <div class="panel-body">
            您已调整页面字体大小
          </div>
        </div>
      


          <div style="margin:6px;">
            <a data-toggle="collapse" data-parent="#accordion" href="#collapseTwo" onclick="javascript:setBackground();" aria-expanded="true" aria-controls="collapseTwo">
              夜间护眼模式
            </a>
        </div>
          <div id="collapseTwo" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingTwo">
          <div class="panel-body">
            夜间模式已经开启，再次单击按钮即可关闭 
          </div>
        </div>

        <div>
            <a data-toggle="collapse" data-parent="#accordion" href="#collapseThree" aria-expanded="true" aria-controls="collapseThree">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;关 于&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</a>
        </div>
         <div id="collapseThree" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingThree">
          <div class="panel-body">
            清峰小栈
          </div>
          <div class="panel-body">
            Copyright © 2023 清峰 All Rights Reserved.
          </div>
        </div>
      </div>


      <hr style="margin-top:0px; margin-bottom:0px; width:80%; border-top: 1px solid #000;">
      <hr style="margin-top:2px; margin-bottom:0px; width:80%; border-top: 3px solid #000;">
      <div class="modal-footer">
        <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button>
      </div>
    </div>
  </div>
</div>
  
  <a id="rocket" href="#top" class=""></a>
  <script type="text/javascript" src="/qingfeng-blog/js/totop.js?v=1.0.0" async=""></script>
  
    <a id="menu-switch"><i class="fa fa-bars fa-lg"></i></a>
  
</body>
</html>